CVE-2022-48512

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Use After Free (UAF) vulnerability in the Vdecoderservice service. Successful exploitation of this vulnerability may cause the image decoding feature to perform abnormally.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-416

Affected software

Vendor	Product	Versions
Huawei	HarmonyOS	2.0.0
Huawei	EMUI	12.0.0

References

https://consumer.huawei.com/en/support/bulletin/2023/7/Vendor Advisory
https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858Vendor Advisory
https://consumer.huawei.com/en/support/bulletin/2023/7/Vendor Advisory
https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858Vendor Advisory

Timeline

Published: Jul 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-485139.8Vulnerability of identity verification being bypassed in the Gallery module. Successful exploitation of this vulnerability may cause out-of-CVE-2022-485147.5The Sepolicy module has inappropriate permission control on the use of Netlink.Successful exploitation of this vulnerability may affect conf CVE-2022-485157.5Vulnerability of inappropriate permission control in Nearby. Successful exploitation of this vulnerability may affect service confidentialit CVE-2022-485167.5Vulnerability that a unique value can be obtained by a third-party app in the DSoftBus module. Successful exploitation of this vulnerability CVE-2022-485177.5Unauthorized service access vulnerability in the DSoftBus module. Successful exploitation of this vulnerability will affect availability.CVE-2022-485185.5Vulnerability of signature verification in the iaware system being initialized later than the time when the system broadcasts are sent. Succ CVE-2022-485197.5Unauthorized access vulnerability in the SystemUI module. Successful exploitation of this vulnerability may affect confidentiality.CVE-2022-485207.5Unauthorized access vulnerability in the SystemUI module. Successful exploitation of this vulnerability may affect confidentiality.CVE-2022-485215.3An issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing CVE-2022-485229.8In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalat CVE-2022-485385.3In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap CVE-2022-485417.1A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the "identify -help" command